Using eval in LHS
by PriyaSha
Input:
0,0,107,32,0,0,0,10,53320,-1,-1,-1,-1,-1,-1
0,0,107,32,0,0,0,10,53320,-1,-1,-1,-1,-1,-1
0,0,107,32,0,0,0,10,53320,-1,-1,-1,-1,-1,-1
0,0,107,32,0,0,0,10,53320,-1,-1,-1,-1,-1,-1
0,0,109,20,0,0,0,19,100644,-1,-1,-1,-1,-1,-1
0,0,109,20,0,0,0,19,100644,-1,-1,-1,-1,-1,-1
0,0,106,28,0,0,0,26,137745,-1,-1,-1,-1,-1,-1
0,0,108,32,0,0,0,67,354281,-1,-1,-1,-1,-1,-1
0,0,105,30,0,0,1,94,501089,-1,-1,-1,-1,-1,-1
Problem:
Should find vehicles with same data (if it occurs more than thrice).
Though eval in rule 'Detect Accident' results in true, consequence is not
fired.
Output:
Added
Not Found -- 107---2
test---2----107
Not Found -- 107---3
test---3----107
Not Found -- 107---4
test---4----107
no of veh : 1
no of veh : 1
no of veh : 1
Not Found -- 109---5
test---1----109
Not Found -- 109---6
test---2----109
Not Found -- 106---7
Please find the DRL below.
package com.hp.hpl.CHAOS.LR;
# importing classes
import java.lang.Integer;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.Iterator;
import com.hp.hpl.CHAOS.Rules.VehicleLocation;
global java.lang.String output
declare VehicleLocation
@role ( event )
@expires ( 1m )
end
declare Statistics
smashedcars : ArrayList
stopped_cars : ArrayList
accidents : ArrayList
collided_at : HashMap
end
rule "Setup statistics"
salience 110
no-loop true
when
not( Statistics( ) )
vehLoc : VehicleLocation()
then
Statistics s = new Statistics();
s.setSmashedcars (new ArrayList());
s.setStopped_cars (new ArrayList());
s.getStopped_cars().add(vehLoc);
s.setCollided_at(new HashMap());
insert( s );
System.out.println("Added");
end
rule "Add to stopped cars"
salience 100
no-loop true
when
vehLoc : VehicleLocation()
$stat : Statistics ()
((not( VehicleLocation(vid == vehLoc.vid) from $stat.getSmashedcars())))
then
modify($stat) {
getStopped_cars().add(vehLoc);
}
System.out.println("Not Found -- " + vehLoc.getVid() + "---" +
$stat.getStopped_cars().size());
end
rule "Identify Collided Vehicles"
salience 90
no-loop true
when
vehLoc : VehicleLocation()
$stat : Statistics ()
$allStoppedcars : ArrayList( size > 0 )
from collect ( VehicleLocation(xway == vehLoc.xway, pos ==
vehLoc.pos, dir == vehLoc.dir, lane == vehLoc.lane) from $stat.stopped_cars)
then
System.out.println("test" + "---" + $allStoppedcars.size() + "----" +
vehLoc.getVid());
modify($stat) {
setCollided_at(collided_at($allStoppedcars, vehLoc.getXway(),
vehLoc.getPos(), vehLoc.getDir(), vehLoc.getLane()));
}
retract (vehLoc);
end
rule "Detect Accident"
salience 80
no-loop true
when
vehLoc : VehicleLocation()
$stat : Statistics ()
eval(collision_occured($stat.getCollided_at()))
then
System.out.println("Detect Accident");
end
function HashMap collided_at(ArrayList stopped_cars, int x, int pos, int
dir, int lane) {
HashMap collided_at = new HashMap();
for (Iterator iterator = stopped_cars.iterator(); iterator.hasNext(); )
{
VehicleLocation vehLoc = (VehicleLocation) iterator.next();
if (vehLoc.getXway() == x
&& vehLoc.getPos() == pos
&& vehLoc.getDir() == dir
&& vehLoc.getLane() == lane) {
int key = vehLoc.getVid();
if (!collided_at.containsKey(key)) {
collided_at.put (key, new Integer(1));
continue;
}
collided_at.put (key,
((Integer)collided_at.get(key)).intValue()+1);
}
}
return collided_at;
}
function boolean collision_occured(HashMap collided_vehicles) {
java.util.Set entries = collided_vehicles.entrySet();
int noOfCollidedVehicles = 0;
java.util.Iterator iterator = entries.iterator();
while ( iterator.hasNext() ) {
java.util.Map.Entry object = (java.util.Map.Entry) iterator.next();
if ((Integer)object.getValue() > 3) {
noOfCollidedVehicles += 1;
}
}
if (noOfCollidedVehicles > 0) {
System.out.println("no of veh : " + noOfCollidedVehicles);
return true;
}
return false;
}
Please let me know what should I correct here.
--
View this message in context: http://www.nabble.com/Using-eval-in-LHS-tp24646946p24646946.html
Sent from the drools - user mailing list archive at Nabble.com.
17 years, 1 month
Problems setting MySQL for the human task process server....
by Cristiano Gavião
Hi,
I was trying to change the persistence settings for human task process
server for using MySQL instead of H2DB.
I was following the Drools Flows Documentation on chapter 5.1.3.:
Configuring Persistence.(https://hudson.jboss.org/hudson/job/drools/lastSuccessfulBui...
#d0e1157)
I read on docs that I should override the persistence.xml of the
drools-process-enterprise.jar, create the drools.session.conf with
some contents (i don`t undestand` what it is...) and put them on my
project META-INF directory... ok?
I created the files as stated on docs but it didn't work... My
example runned ok, but using the H2DB and not my MYSQL.
// Use persistence.xml configuration
emf =
Persistence.createEntityManagerFactory("org.drools.persistence.jpa");
taskService = new TaskService(emf);
taskSession = taskService.createSession();
server = new MinaTaskServer(taskService);
Thread thread = new Thread(server);
thread.start();
Thread.sleep(500);
System.out.println("Server started ...");
<properties>
<property name="hibernate.dialect"
value="org.hibernate.dialect.MySQL5Dialect" />
<property name="hibernate.connection.driver_class"
value="com.mysql.jdbc.Driver" />
<property name="hibernate.connection.url" value="jdbc:mysql://
localhost/drools" />
<property name="hibernate.connection.username" value="root" />
<property name="hibernate.connection.password" value="" />
<property name="hibernate.connection.autocommit" value="false" />
<property name="hibernate.max_fetch_depth" value="3" />
<property name="hibernate.hbm2ddl.auto" value="create-drop" />
<property name="hibernate.show_sql" value="true" />
</properties>
After some investigation I could see that the example recommended by
Mark Proctor (TaskLifeCycleTest.java, and others that use
MinaTaskServer) use <persistence-unit name = "org.drools.task"> that
is setting on drools-process-task.jar and not the
"org.drools.persistence.jpa" on drools-process-enterprise.jar as
stated on documentation...
First question, which one should I use for use the Drools Flows Server
and Client?
emf =
Persistence.createEntityManagerFactory( "org.drools.task" );
emf =
Persistence.createEntityManagerFactory("org.drools.persistence.jpa");
I test the first option. I changed the persistence.xml file and use
the code below:
// Use persistence.xml configuration
emf = Persistence.createEntityManagerFactory("org.drools.task");
taskService = new TaskService(emf);
taskSession = taskService.createSession();
server = new MinaTaskServer(taskService);
Thread thread = new Thread(server);
thread.start();
Thread.sleep(500);
System.out.println("Server started ...");
Hummm.... It runs and connect well to my MySQL. but now it brings me a
error...
java.lang.IllegalArgumentException: Named query not found:
UnescalatedDeadlines
at
org
.hibernate
.ejb
.AbstractEntityManagerImpl
.createNamedQuery(AbstractEntityManagerImpl.java:108)
at org.drools.task.service.TaskService.<init>(TaskService.java:84)
at org.drools.task.service.TaskService.<init>(TaskService.java:68)
It sounds like it was not possible to find orm.xml that is on META-INF
of drools-process-task.jar.
But when I copy the orm.xml file to my project META-INF it works ok....
Could someone give some ideas how can I solve this problem..
Thanks a lot
Cristiano
17 years, 1 month
Unable to resolve object reference
by Narendra Valada
Hello,
I am getting "Unable to resolve object reference" on certain inner classes.
I seem to get this error on inner classes that have been defined within other inner classes.
Since I am using XML Beans, I am not able to reference some of the generated classes due to this limitation.
Is this a known limitation of JBoss Rules or is it a limitation of the JANINO compiler?
Here is a example:
package com.sample;
public class Outer {
public class Inner {
public boolean inner=false;
public class InnerInner {
}
}
}
Here is the rule:
package com.sample
import com.sample.Outer.Inner.InnerInner;
rule "Hello World 1"
when
InnerInner()
then
System.out.println("");
end
17 years, 1 month
Re: [rules-users] CEP Rule Help Needed
by Greg Barton
So do you mean this didn't work:
myWorkingMemoryEP = ksession.getWorkingMemoryEntryPoint(correlatorName);
for (Fact a : Facts)
ksession.getWorkingMemoryEntryPoint(correlatorName).insert(a);
...but this did?
myWorkingMemoryEP = ksession.getWorkingMemoryEntryPoint(correlatorName);
for (Fact a : Facts)
myWorkingMemoryEP.insert(a);
--- On Thu, 7/23/09, Nestor Tarin Burriel <nestabur(a)gmail.com> wrote:
> From: Nestor Tarin Burriel <nestabur(a)gmail.com>
> Subject: Re: [rules-users] CEP Rule Help Needed
> To: "Rules Users List" <rules-users(a)lists.jboss.org>
> Date: Thursday, July 23, 2009, 9:47 AM
> Finally I've solved my problem. It
> was in the engine:
>
> Looking the doc, for inserting a new fact into a stream of
> the working memory says:
>
> ksession.getWorkingMemoryEntryPoint("MyEntryPoint").insert();
>
>
> Which is perfect but not for my enviroment ;), I was
> inserting the events in differents WM cause in each one I
> did
> ksession.getWorkingMemoryEntryPoint("MyEntryPoint").insert(myFact);
> so I solved it doing:
>
>
> myWorkingMemoryEP =
> ksession.getWorkingMemoryEntryPoint(correlatorName);
>
> for (Fact a : Facts)
> myWorkingMemoryEP.insert(a);
>
> I dont know if this is the correct use of EntryPoints bu it
> works!
>
>
> Thanks to everybody especially Greg and Priya :)
>
> 2009/7/23 PriyaKathan <nash.8103(a)gmail.com>
>
> Hi
>
> Find attached working example for CEP rule with the
> scenario you stated.Here I used Psuedo
> clock.Hope this would help you to understand
> better.
> Regards,
>
> Priya
>
> 2009/7/23 Nestor Tarin Burriel
> <nestabur(a)gmail.com>
>
>
> Hi again Greg,
>
> I've tried your suggestion and it seems like the facts
> that is the rule checking are the same.
>
> This is my last try:
>
> rule "SnortRuleRetract"
> dialect "mvel"
>
>
>
> when
> $s1 : Snort( sig_name != "(portscan)
> Open Port")
> $s2 : Snort ( sig_name !=
> "(portscan) Open Port" , id != $s1.id)
> then
>
>
> retract($s2);
>
> System.out.println(" ********* Deleting
> from WM");
> end
>
> And is never fired ...
>
> There are no more rules in the package, this is the only
> one ... so I don't understand anything ... could be the
> error in the engine? I dont retract any fact ... as you can
> see in my code ...
>
>
>
>
> NEStor
>
> 2009/7/23 Nestor Tarin Burriel
> <nestabur(a)gmail.com>
>
>
>
> Yes, that is the purpose ;)
>
> I will try ;)
>
> Thanks 4 your help
>
> 2009/7/22 Greg Barton <greg_barton(a)yahoo.com>
>
>
>
>
>
>
> Ah, overlooked that second rule. Have you tried the
> overlap operator?
>
>
>
> So, just to clarify, the purpose of the two rules should
> be:
>
>
>
> SnortRule: If two Snort events that are not port scans of
> an open port on the same destination arrive more than 5
> minutes apart, delete the earlier one.
>
>
>
> SnortRuleRetract: If two Snort events that are not port
> scans of an open port on any two destinations arrive within
> 5 minutes of each other, delete the earlier one.
>
>
>
> Have you tried removing the temporal operators completely,
> just for testing purposes? What happens? i.e.
>
>
>
> "TimelessSnortRule"
>
> $s1 : Snort( sig_name != "(portscan)
> Open Port") from entry-point "Correlator"
>
> $s2 : Snort( sig_name != "(portscan)
> Open Port" , id != $s1.id, ip_dst == $s1.ip_dst) from
> entry-point "Correlator"
>
>
>
> "TimelessSnortRuleRetract"
>
> $s1 : Snort( sig_name != "(portscan)
> Open Port") from entry-point "Correlator"
>
> $s2 : Snort ( sig_name !=
> "(portscan) Open Port" , id != $s1.id) from
> entry-point "Correlator"
>
>
>
>
>
> --- On Wed, 7/22/09, Nestor Tarin Burriel <nestabur(a)gmail.com>
> wrote:
>
>
>
> > From: Nestor Tarin Burriel <nestabur(a)gmail.com>
>
> > Subject: Re: [rules-users] CEP Rule Help Needed
>
> > To: "Rules Users List" <rules-users(a)lists.jboss.org>
>
> > Date: Wednesday, July 22, 2009, 1:47 PM
>
> > Thanks Greg,
>
> >
>
> > As you can see in the code I sent, I have the 2
>
> > implementations:
>
> >
>
> > "SnortRule"
>
> >
>
> > $s1 : Snort( sig_name !=
>
> > "(portscan) Open Port") from entry-point
>
> > "Correlator"
>
> >
>
> > $s2 : Snort( sig_name !=
> "(portscan)
>
> > Open Port" , id != $s1.id, ip_dst ==
> $s1.ip_dst, this
>
> > after [5m] $s1) from entry-point
> "Correlator"
>
> >
>
> >
>
> > "SnortRuleRetract"
>
> > $s1 : Snort( sig_name !=
>
> > "(portscan) Open Port") from entry-point
>
> > "Correlator"
>
> > $s2 : Snort ( sig_name !=
> "(portscan)
>
> > Open Port" , id != $s1.id, this after
> [0m,5m] $s1) from
>
> > entry-point "Correlator"
>
> >
>
> >
>
> > and any of them are thrown
>
> >
>
> > ...
>
> >
>
> > 2009/7/22 Greg Barton <greg_barton(a)yahoo.com>
>
> >
>
> >
>
> >
>
> > Maybe this is a problem of language. Here's what
> you
>
> > say the rule should do:
>
> >
>
> >
>
> >
>
> > 'After receiving a fact "MyModel" wich
> name
>
> > != "aaa", if arrives another
>
> >
>
> > with same ip and different id after a
>
> > period between 0 and 5 minutes the
>
> >
>
> > rule have to retract the last one and keep the first
>
> > fact (the older one)'
>
> >
>
> >
>
> >
>
> > Which I would interpret as "Event 1 comes in,
> then
>
> > event 2 comes in between 0 and 5 minutes later."
> Does
>
> > that sound right?
>
> >
>
> >
>
> >
>
> > And here's the rule that you think fits the
>
> > requirements:
>
> >
>
> >
>
> >
>
> > rule "SnortRule"
>
> >
>
> > salience 2
>
> >
>
> > dialect "mvel"
>
> >
>
> > when
>
> >
>
> > $s1 : Snort( sig_name != "(portscan)
> Open
>
> > Port") from entry-point "Correlator"
>
> >
>
> > $s2 : Snort( sig_name != "(portscan)
> Open
>
> > Port" , id != $s1.id, ip_dst == $s1.ip_dst, this
>
> > after [5m] $s1) from entry-point
> "Correlator"
>
> >
>
> > then
>
> >
>
> >
> System.out.println("******************
>
> > Snort Alert!!!!" + $s1.getData());
>
> >
>
> > retract($s1);
>
> >
>
> > end
>
> >
>
> >
>
> >
>
> > Check out the docs, though:
>
> >
>
> >
>
> >
>
> > https://hudson.jboss.org/hudson/job/drools/lastSuccessfulBuild/artifact/t...
>
>
>
>
>
> >
>
> >
>
> >
>
> >
>
> > The after operator in this case would check that (5m
> <=
>
> > $s2.startTimestamp - $s1.endTimeStamp <=
> +infinity).
>
> >
>
> >
>
> >
>
> > So the rule actually implements "Event 1 comes
> in,
>
> > then event 2 happens at leat 5 minutes later."
>
> >
>
> >
>
> >
>
> > If you use the second argument of after I think it
> would
>
> > work:
>
> >
>
> >
>
> >
>
> > $s2 : Snort( sig_name != "(portscan) Open
> Port" ,
>
> > id != $s1.id, ip_dst == $s1.ip_dst, this
>
> > after [0m,5m] $s1) from entry-point
> "Correlator"
>
> >
>
> >
>
> >
>
> > According to the docs this should check that (0m
> <=
>
> > $s2.startTimestamp - $s1.endTimeStamp <= 5m).
>
> >
>
> >
>
> >
>
> > You could alternately use "overlaps".
> Place an
>
> > @duration(5m) annotation on the Snort declaration and
> try
>
> > this condition:
>
> >
>
> >
>
> >
>
> > $s2 : Snort( sig_name != "(portscan) Open
> Port" ,
>
> > id != $s1.id, ip_dst == $s1.ip_dst, this
>
> > overlaps $s1) from entry-point "Correlator"
>
> >
>
> >
>
> >
>
> >
>
> >
>
> >
>
> >
>
> >
>
> >
>
> >
>
> >
>
> >
>
> >
>
> > _______________________________________________
>
> >
>
> > rules-users mailing list
>
> >
>
> > rules-users(a)lists.jboss.org
>
> >
>
> > https://lists.jboss.org/mailman/listinfo/rules-users
>
> >
>
> >
>
> >
>
> >
>
> > -----Inline Attachment Follows-----
>
> >
>
> > _______________________________________________
>
> > rules-users mailing list
>
> > rules-users(a)lists.jboss.org
>
> > https://lists.jboss.org/mailman/listinfo/rules-users
>
> >
>
>
>
>
>
>
>
>
>
> _______________________________________________
>
> rules-users mailing list
>
> rules-users(a)lists.jboss.org
>
> https://lists.jboss.org/mailman/listinfo/rules-users
>
>
>
>
>
>
> _______________________________________________
>
> rules-users mailing list
>
> rules-users(a)lists.jboss.org
>
> https://lists.jboss.org/mailman/listinfo/rules-users
>
>
>
>
>
> --
> Regards,
> PriyaKathan
>
>
>
> _______________________________________________
>
> rules-users mailing list
>
> rules-users(a)lists.jboss.org
>
> https://lists.jboss.org/mailman/listinfo/rules-users
>
>
>
>
>
> -----Inline Attachment Follows-----
>
> _______________________________________________
> rules-users mailing list
> rules-users(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/rules-users
>
17 years, 1 month
Re: [rules-users] CEP Rule Help Needed
by Greg Barton
Ah, overlooked that second rule. Have you tried the overlap operator?
So, just to clarify, the purpose of the two rules should be:
SnortRule: If two Snort events that are not port scans of an open port on the same destination arrive more than 5 minutes apart, delete the earlier one.
SnortRuleRetract: If two Snort events that are not port scans of an open port on any two destinations arrive within 5 minutes of each other, delete the earlier one.
Have you tried removing the temporal operators completely, just for testing purposes? What happens? i.e.
"TimelessSnortRule"
$s1 : Snort( sig_name != "(portscan) Open Port") from entry-point "Correlator"
$s2 : Snort( sig_name != "(portscan) Open Port" , id != $s1.id, ip_dst == $s1.ip_dst) from entry-point "Correlator"
"TimelessSnortRuleRetract"
$s1 : Snort( sig_name != "(portscan) Open Port") from entry-point "Correlator"
$s2 : Snort ( sig_name != "(portscan) Open Port" , id != $s1.id) from entry-point "Correlator"
--- On Wed, 7/22/09, Nestor Tarin Burriel <nestabur(a)gmail.com> wrote:
> From: Nestor Tarin Burriel <nestabur(a)gmail.com>
> Subject: Re: [rules-users] CEP Rule Help Needed
> To: "Rules Users List" <rules-users(a)lists.jboss.org>
> Date: Wednesday, July 22, 2009, 1:47 PM
> Thanks Greg,
>
> As you can see in the code I sent, I have the 2
> implementations:
>
> "SnortRule"
>
> $s1 : Snort( sig_name !=
> "(portscan) Open Port") from entry-point
> "Correlator"
>
> $s2 : Snort( sig_name != "(portscan)
> Open Port" , id != $s1.id, ip_dst == $s1.ip_dst, this
> after [5m] $s1) from entry-point "Correlator"
>
>
> "SnortRuleRetract"
> $s1 : Snort( sig_name !=
> "(portscan) Open Port") from entry-point
> "Correlator"
> $s2 : Snort ( sig_name != "(portscan)
> Open Port" , id != $s1.id, this after [0m,5m] $s1) from
> entry-point "Correlator"
>
>
> and any of them are thrown
>
> ...
>
> 2009/7/22 Greg Barton <greg_barton(a)yahoo.com>
>
>
>
> Maybe this is a problem of language. Here's what you
> say the rule should do:
>
>
>
> 'After receiving a fact "MyModel" wich name
> != "aaa", if arrives another
>
> with same ip and different id after a
> period between 0 and 5 minutes the
>
> rule have to retract the last one and keep the first
> fact (the older one)'
>
>
>
> Which I would interpret as "Event 1 comes in, then
> event 2 comes in between 0 and 5 minutes later." Does
> that sound right?
>
>
>
> And here's the rule that you think fits the
> requirements:
>
>
>
> rule "SnortRule"
>
> salience 2
>
> dialect "mvel"
>
> when
>
> $s1 : Snort( sig_name != "(portscan) Open
> Port") from entry-point "Correlator"
>
> $s2 : Snort( sig_name != "(portscan) Open
> Port" , id != $s1.id, ip_dst == $s1.ip_dst, this
> after [5m] $s1) from entry-point "Correlator"
>
> then
>
> System.out.println("******************
> Snort Alert!!!!" + $s1.getData());
>
> retract($s1);
>
> end
>
>
>
> Check out the docs, though:
>
>
>
> https://hudson.jboss.org/hudson/job/drools/lastSuccessfulBuild/artifact/t...
>
>
>
>
> The after operator in this case would check that (5m <=
> $s2.startTimestamp - $s1.endTimeStamp <= +infinity).
>
>
>
> So the rule actually implements "Event 1 comes in,
> then event 2 happens at leat 5 minutes later."
>
>
>
> If you use the second argument of after I think it would
> work:
>
>
>
> $s2 : Snort( sig_name != "(portscan) Open Port" ,
> id != $s1.id, ip_dst == $s1.ip_dst, this
> after [0m,5m] $s1) from entry-point "Correlator"
>
>
>
> According to the docs this should check that (0m <=
> $s2.startTimestamp - $s1.endTimeStamp <= 5m).
>
>
>
> You could alternately use "overlaps". Place an
> @duration(5m) annotation on the Snort declaration and try
> this condition:
>
>
>
> $s2 : Snort( sig_name != "(portscan) Open Port" ,
> id != $s1.id, ip_dst == $s1.ip_dst, this
> overlaps $s1) from entry-point "Correlator"
>
>
>
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
>
> rules-users mailing list
>
> rules-users(a)lists.jboss.org
>
> https://lists.jboss.org/mailman/listinfo/rules-users
>
>
>
>
> -----Inline Attachment Follows-----
>
> _______________________________________________
> rules-users mailing list
> rules-users(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/rules-users
>
17 years, 1 month
Webguided decision table and nested objects
by Wishing Carebear
Hello:
I have a facts objects with nested objects : example:
Employee
name
Address
street
city
Wondering if it is possible to use Webguided decision table at the nested
object level (in the above example Address.street)
Thanks,
cabear
17 years, 1 month
Re: [rules-users] CEP Rule Help Needed
by Greg Barton
Without @timestamp the event time is the insertion time.
--- On Thu, 7/23/09, PriyaKathan <nash.8103(a)gmail.com> wrote:
> From: PriyaKathan <nash.8103(a)gmail.com>
> Subject: Re: [rules-users] CEP Rule Help Needed
> To: "Rules Users List" <rules-users(a)lists.jboss.org>
> Date: Thursday, July 23, 2009, 12:37 AM
> Hi,
> I found one thing missing here...It
> is @timestamp in event declaration...
17 years, 1 month
Re: [rules-users] CEP Rule Help Needed
by Greg Barton
Maybe this is a problem of language. Here's what you say the rule should do:
'After receiving a fact "MyModel" wich name != "aaa", if arrives another
with same ip and different id after a period between 0 and 5 minutes the
rule have to retract the last one and keep the first fact (the older one)'
Which I would interpret as "Event 1 comes in, then event 2 comes in between 0 and 5 minutes later." Does that sound right?
And here's the rule that you think fits the requirements:
rule "SnortRule"
salience 2
dialect "mvel"
when
$s1 : Snort( sig_name != "(portscan) Open Port") from entry-point "Correlator"
$s2 : Snort( sig_name != "(portscan) Open Port" , id != $s1.id, ip_dst == $s1.ip_dst, this after [5m] $s1) from entry-point "Correlator"
then
System.out.println("****************** Snort Alert!!!!" + $s1.getData());
retract($s1);
end
Check out the docs, though:
https://hudson.jboss.org/hudson/job/drools/lastSuccessfulBuild/artifact/t...
The after operator in this case would check that (5m <= $s2.startTimestamp - $s1.endTimeStamp <= +infinity).
So the rule actually implements "Event 1 comes in, then event 2 happens at leat 5 minutes later."
If you use the second argument of after I think it would work:
$s2 : Snort( sig_name != "(portscan) Open Port" , id != $s1.id, ip_dst == $s1.ip_dst, this after [0m,5m] $s1) from entry-point "Correlator"
According to the docs this should check that (0m <= $s2.startTimestamp - $s1.endTimeStamp <= 5m).
You could alternately use "overlaps". Place an @duration(5m) annotation on the Snort declaration and try this condition:
$s2 : Snort( sig_name != "(portscan) Open Port" , id != $s1.id, ip_dst == $s1.ip_dst, this overlaps $s1) from entry-point "Correlator"
17 years, 1 month
Re: [rules-users] DSL matching return wrong DRL
by Matt Geis
The question has already been answered, but to help you understand how DSL expansion works, here's what happens.
1. The expander goes down the list and matches the first expression against all lines in your rules. So,
rule dsl2drl_1
when
Get month summer
then
Print months;
end
becomes
rule dsl2drl_1
when
$month: Month(); summer
then
Print months;
end
2. The expander tries to match the second expression, and fails.
3. The expander tries to match the third expression, and succeeds, leaving you with the following DRL.
rule dsl2drl_1
when
$month: Month(); summer
then
System.out.println("Month: " + $month.getId());;
end
Looking at the LHS of the rule, this will not compile.
Matt
17 years, 1 month
Re: [rules-users] CEP Rule Help Needed
by Greg Barton
--- On Wed, 7/22/09, Nestor Tarin Burriel <nestabur(a)gmail.com> wrote:
> So I dont understand why my CEP rules never fires ...
Ah, the eternal lament of the rules developer. :)
Have you tried removing conditions until it does fire?
17 years, 1 month
